Attributable
The evidence identifies the system, version, owner, control, decision and period it represents.
Portable Trust
Build evidence once. Keep the duties distinct.
Portable Trust is a disciplined way to reuse well-scoped assurance evidence without pretending that one test, one contract or one framework satisfies every legal and operational duty. Evidence can travel; accountability and applicability analysis cannot be outsourced.
What makes evidence portable
Protected
Collection, storage and access controls make alteration detectable and preserve relevant chain of custody.
Scoped
Recipients can see assumptions, coverage, limitations, exceptions and unresolved gaps.
Current
Material changes trigger reassessment rather than relying indefinitely on a historical result.
Reuse decision
- Define the receiving decision and its applicable duties.
- Confirm that the evidence concerns the same system, version, use case and control objective.
- Test provenance, integrity, freshness and independence.
- Document uncovered requirements and additional testing.
- Record who accepted the evidence and the residual risk.